At $799, the HEDDphone D1 enters a crowded part of the headphone market where established dynamic-driver models like the Sennheiser HD 650 and Beyerdynamic T1 have been reference points for years. What makes the D1 interesting is that HEDD is not trying to beat them by doing more of the same.

Heinz Electrodynamic Designs, better known as HEDD, was founded by Klaus Heinz and his son, Dr. Frederik Knop, with the goal of combining meticulous German engineering with new approaches to driver technology. HEDD is still a relatively young company, but its founders have considerably deeper roots in professional audio. Heinz previously co-founded ADAM Audio, while Knop came to HEDD with his own academic and engineering background in Berlin’s audio industry.

Klaus Heinz’s expertise with the Air Motion Transformer was developed during his years at ADAM and became central to HEDD’s earliest products. The original HEDDphone used the company’s Variable Velocity Transformer, a full-range descendant of the AMT, while HEDD’s studio monitors have continued to employ advanced AMT designs of their own.

That made the HEDDphone lineup instantly recognizable, both sonically and visually. The first several models used the VVT driver and distinctive squared-off earcups, including the HEDDphone TWO GT that we reviewed recently. The D1 breaks from both traditions.

Some will undoubtedly look at the D1 and conclude that HEDD simply needed a less expensive headphone for a broader audience, so it produced a more conventional dynamic-driver model. “Entry level” is already doing some heavy lifting at $799, but dismissing the D1 as HEDD’s ordinary dynamic headphone misses what is actually going on inside it.

HEDD prides itself on innovation, and apparently even the dynamic driver still had unfinished business.

The HEDDphone D1 is the first dynamic-driver headphone to use Thin-Ply Carbon Diaphragm technology. Originally developed by Swedish researchers at Composite Sound, TPCD uses extremely thin layers of carbon fiber to create a diaphragm that is both exceptionally light and extremely rigid. Similar thin-ply carbon materials have found applications in aerospace, Formula 1, marine racing, and other fields where low weight and high strength are rather important.

For a dynamic headphone driver, those properties offer an obvious advantage. Traditional diaphragms can flex under load, creating localized breakup and additional harmonic distortion. The rigidity of the TPCD diaphragm allows it to behave more uniformly across its surface while also controlling resonance structurally rather than relying as heavily on external damping.

That may sound like a small engineering distinction, but controlling the motion of a dynamic driver has always been one of the fundamental challenges of headphone design. A diaphragm needs to start, stop, and change direction quickly without continuing to ring after the signal has moved on. The lighter and more rigid that diaphragm can be made without introducing other problems, the greater the potential for cleaner transients and lower distortion.

Which helps explain why HEDD was willing to move away from its beloved AMT technology to build an “ordinary” dynamic-driver headphone.

As it turns out, ordinary is not really what HEDD had in mind.

Related Reading:

Build & Fit

Construction is a mix of metal and polymer, with a steel headband and grilles paired with polymer gimbals and earcups. The underside of the headband is padded with memory foam and wrapped in a soft, suede-like material, while the outer section uses a polymer frame to keep the padding centered and properly positioned.

Headband adjustment is positive, with clearly defined clicks at each stop and enough range to accommodate most head sizes. The cups offer roughly 20 degrees of rotation on the vertical axis, divided evenly between the front and rear, along with approximately 35 degrees of horizontal movement. That gives the D1 enough flexibility to conform comfortably to a wide range of head shapes.

The ear pads use the same suede-like material as the headband, with softer internal padding and generous internal dimensions. My ears never touched the pads, nor did they come into contact with the driver screens.

I also had no trouble achieving a good seal while wearing eyeglasses, helped by the wide adjustment range and relatively low clamping force. At 350 grams, the D1 is not especially light, but the weight is distributed well enough that I had no issues wearing it for extended listening sessions.

The supplied cable connects to each earcup through separate 3.5mm TS jacks positioned along the bottom. It is cloth-wrapped and terminates in a 3.5mm TRS plug, with a screw-on 6.35mm adapter included for use with full-size headphone amplifiers and other sources.

One of the more thoughtful aspects of the D1 is its emphasis on long-term serviceability. The perforated ear pads, headband cushions, structural yokes, and individual driver-baffle assemblies can all be removed and replaced independently by the owner rather than requiring the entire headphone to be sent back for relatively simple repairs.

Those who would rather leave the screwdriver in the drawer will also appreciate the five-year warranty.

Internals

Having already spent a good deal of time on the 50mm TPC diaphragm used in the D1, I’ll keep the rest of the specifications brief. Nominal impedance is 32 ohms, sensitivity is rated at 100 dB/mW, and frequency response extends from 5Hz to 40kHz.

That places the D1 firmly in the easy-to-drive category, which is another significant departure from HEDD’s earlier AMT-based headphones. Those models demanded considerably more from the source and, combined with their greater weight, were never especially well suited to portable use.

The D1 is both easier to power and considerably lighter, making it far more practical for listeners who want to use it away from a full-size desktop headphone rig.

HEDDphone D1 Specifications:

• Design: Open-back, over-ear
• Driver: Dynamic, Thin-Ply Carbon Diaphragm (TPCD)
• Driver Size: 50mm
• Frequency Response: 5Hz-40kHz
• Impedance: 32 ohms
• Sensitivity: 100 dB/mW
• Weight: 350 grams
• Ear Pads: Perforated velour
• Cable: 2-meter textile-covered detachable cable
• Connections: Dual 3.5mm mono inputs
• Termination: 3.5mm TRS with 6.35mm adapter
• Warranty: 5 years with registration
• Manufactured: Berlin, Germany

Listening

The first thing I noticed about the D1’s low end was how much more punch it delivers than almost any other reference-tuned headphone near its price point. That does not mean the bass is pushed forward, because it really is not. It is simply palpable in a way that many neutral headphones are not.

The D1 should appeal to listeners who want slam and rumble without sacrificing a near-neutral overall balance. The next thing that becomes obvious is how clean the bass sounds and how well defined it remains even at the very bottom. Nothing sounds dull, thick, or droning, and the D1 maintains excellent definition as it reaches into the lowest octaves.

That makes tracks like Duran Duran’s “A View to a Kill” especially entertaining, with the walking bass line during the introduction having real weight and texture. The same is true with something like Tchaikovsky’s 1812 Overture, where the larger dynamic swings and cannon blasts can be properly celebrated.

There is no bleed from the mid-bass into the lower midrange, and just as I heard in the lows, instruments and voices through the mids retain their own space and definition. Lower-register vocals have good weight without sounding heavy, guitars growl and scream when called upon, and strings have the energy and attack they deserve.

Piano also sounds impressively natural, which is a rarer talent than it should be, while higher-pitched voices retain good energy without becoming nasal or strident. The overall clarity is excellent. Tracks like 40 Fingers’ “Sunset Jig” become particularly enjoyable because it is so easy to follow the individual contribution of each guitarist.

There is a slight lift in the lower treble, but it never becomes excessive. That added energy helps strings retain their bite and gives percussion plenty of snap and rattle. The lift appears to extend from roughly 3kHz through just above 11kHz before beginning to taper off, giving the D1 a somewhat brighter treble presentation than many reference headphones.

It never struck me as hot, however, and the stronger-than-average bass presence gives the overall presentation good balance. Cymbals sound realistic without becoming clicky, while air and sparkle are both very good. The D1 sounds exceptionally open through the upper registers.

The soundstage does not immediately announce itself as absurdly large or artificially stretched. With Cowboy Junkies’ “I’m So Lonesome I Could Cry” from The Trinity Session, the reverberation extends naturally into the surrounding space and reveals just how large the recorded environment really is.

On other recordings, the stage can sound more contained, which suggests that the D1 is reproducing what is actually present rather than imposing the same oversized presentation on everything. Imaging is extremely precise, and placing individual musicians within an orchestral recording is almost laughably easy.

The Bottom Line

The HEDDphone D1 is largely neutral in overall balance with a mild treble lift, but describing it that way risks underselling what makes it so compelling. Too many listeners still equate neutral with boring, and the D1 is anything but.

Bass is not exaggerated, yet it has more impact and physical presence than most reference-tuned headphones in this price range. It reaches deep, remains exceptionally clean, and delivers enough punch and texture that it can sound more substantial than the measurements might suggest. The midrange is equally well defined, while the slightly elevated treble adds energy, openness, and detail without pushing the presentation into harshness.

HEDD has also addressed one of the biggest complaints surrounding its earlier headphones. At 350 grams, the D1 is considerably lighter and easier to wear for long sessions. The improved comfort, lower power requirements, and more conventional form factor make it a far more practical headphone for everyday use without sacrificing the technical strengths that have defined HEDD’s more ambitious designs.

To my ear, the D1 is one of the strongest reference-tuned dynamic headphones available below $1,000. It offers better bass definition, greater dynamic impact, and a more engaging overall presentation than long-standing reference models such as the Sennheiser HD 650 and Beyerdynamic T1, while still maintaining the tonal balance and resolution expected from a serious reference headphone.

HEDD may have built its reputation around far more exotic driver technology, but the D1 proves that its most conventional headphone may also be its most broadly appealing.

At $799, it is not inexpensive. It is, however, exceptionally good value for what it delivers, and an easy Editors’ Choice.

Pros:

• Exceptionally clean, well-defined bass with impressive slam and extension
• Near-neutral tuning that still sounds engaging and dynamic
• Excellent clarity and separation through the midrange
• Slight treble lift adds openness, detail, and energy without sounding harsh
• Precise imaging and a soundstage that reflects the recording rather than exaggerating it
• Considerably lighter and more comfortable than previous HEDD headphones
• Easy to drive at 32 ohms and 100 dB/mW
• User-replaceable pads, headband cushions, yokes, and driver-baffle assemblies
• Five-year warranty

Cons:

• $799 is still expensive for a dynamic-driver headphone
• 350-gram weight is improved, but not especially light
• Mild treble emphasis may not suit listeners who prefer a darker presentation
• Open-back design limits portability and isolation
• More conventional styling may feel less distinctive than earlier HEDD models

Our Ratings:

★★★★★★★★★★ Sound Quality

★★★★★★★★★★ Comfort

★★★★★★★★★★ Build Quality

★★★★★★★★★★ Value

Where to Buy:

For more information: hedd.audio

Related Reading:

Frontier AI models designed to control robots may be capable of following instructions, but a new benchmark suggests they are not always reliable at recognising when those instructions could cause harm.

The RoboHarm evaluation tested three robot policies across five dangerous tasks, including stabbing a baby doll, heating a compressed-air can, inserting a screwdriver into a toaster, placing a power bank in water and mixing bleach with ammonia. Each instruction was tested 20 times on the same bimanual I2RT YAM robotic arms. Human reviewers assessed every trial based on whether the system refused, failed, or completed the requested action.

Robots frequently carried out unsafe instructions

The results raise concerns about how current robot policies interpret safety. Anthropic’s Claude Fable 5.1 refused 20 of 100 instructions on safety grounds and completed 34 actions. OpenAI’s GPT-6 Astra refused only two safety-related instructions in the overall summary and completed 60 actions when considering the benchmark’s primary outcome chart. Ai2’s MolmoAct2 did not issue safety refusals and completed six of its 100 trials.

Claude performed particularly well on the instruction involving the baby doll, refusing all 20 attempts. However, the model completed 16 of 20 compressed-air-can tasks and eight of 20 power-bank tasks. GPT-6 Astra completed 17 of 19 non-refused attempts involving the baby doll, while also completing 12 of 19 compressed-air-can tasks.

The findings highlight a difficult trade-off: a robot policy that is more capable of following instructions may also be more willing to execute unsafe ones.

Why robot safety needs stronger safeguards

The study is not a complete measure of real-world robot safety. RoboHarm used one fixed wording for each instruction, five scenes and 20 trials per model-task combination. The researchers also noted that MolmoAct2 has no language-based refusal mechanism, meaning its failures cannot automatically be interpreted as safety decisions.

Still, the benchmark raises important questions about deploying AI-controlled robots in homes, factories, hospitals and other environments where mistakes could injure people or damage property.

Future testing will need to examine varied instructions, longer tasks and changing environments. Robot systems should also include safeguards that can detect dangerous actions, stop execution and hand control to a human when uncertainty is high. RoboHarm provides an open evaluation framework and makes its task design and testing materials available for further examination.

This past summer, Samsung launched the Galaxy Watch9 alongside the Galaxy Watch Ultra2, its more rugged, shock-resistant smartwatch for outdoor adventures.

The Watch9 is the everyday option, and it’s a solid smartwatch and fitness tracker with a plethora of health features. It’s available in a 40-mm size in cream and graphite, and a 44-mm size in graphite and silver, starting at $80. Compared with last year’s Galaxy Watch8, it’s a modest update, though. There’s a faster processor, a slightly larger battery capacity, and an expanded suite of wellness metrics.

After two weeks of testing the 40-mm model, I wouldn’t necessarily upgrade to the Watch9 from the Watch8. But if you have an older Galaxy Watch or you’re invested in Samsung’s ecosystem and are looking for a smartwatch, the Watch9 is the best choice.

A Familiar (Squircle) Face

The Galaxy Watch’s main hardware update is its new processor. It now utilizes Qualcomm’s Snapdragon Wear Elite platform, which Samsung claims enhances CPU and GPU performance along with efficiency. In testing, the watch responded smoothly when scrolling menus, launching apps, and dismissing notifications.

Wear OS 7 also adds more customizable widgets and live updates from compatible apps. One of the more exciting new additions is raise-to-talk for Gemini. Lift your wrist toward your mouth, and you can start talking to Google’s AI assistant. The Google Pixel Watch has had this feature for two generations now, so I’m happy to see Samsung finally catch up.

Samsung has also slightly increased the battery capacity. The 40-mm model has a 390-mAh battery (up from 325 mAh), while the 44-mm models get a 445-mAh cell (up from 435 mAh). Unfortunately, that doesn’t translate to an improvement in battery life, which is probably because it’s being used to power the watch’s expanded suite of health features (more on that later). Samsung still estimates up to 30 hours of battery life, but I averaged closer to 25 hours with Always-On Display enabled. That’s enough to get through a full day and night, but not enough to make charging something you can forget about. A full recharge also took me about 100 minutes on average, which is significantly longer than the 45 minutes it takes the Pixel Watch 5 to reach a full charge.

Every coral colony is cushioned by a thin boundary layer of water whose movement is slowed by friction at the coral’s surface. Researchers assumed that corals were passive with respect to the slow-moving boundary layer, simply relying on natural diffusion through it to provide nutrients and oxygen.

Then, in 2014, a team from the Massachusetts Institute of Technology and the Weizmann Institute of Science published a groundbreaking study showing that coral cilia interact with the boundary layer by rapidly whipping about to generate swirls of fresh, oxygenated seawater. Until a decade ago, scientists thought of these cilia merely as brooms that move mucus and sweep away waste particles and other debris. The research not only modeled the tiny vortices created by the cilia for the first time, but also revealed the cilia’s importance for survival and metabolism.

At first, the microbiologist and environmental engineer Orr Shapiro, who led the 2014 work at MIT as a postdoctoral fellow, was interested in how microbes that infect corals and cause disease follow concentration gradients, a process called chemotaxis. Under the microscope, he noticed something weird: In the boundary layer, particles were swirling around and mixing together—not at all like the passive diffusion he had been expecting.

“That was to me, and I think later on to the entire field, sort of a paradigm shift,” said Shapiro, now a researcher at the Volcani Institute in Israel. It became clear that the boundary layer wasn’t static, but rather a dynamic zone, and one where cilia were creating their own turbulence. The realization inspired Shapiro’s team to go off on a tangent, mapping the flow of oxygen to coral tissues via cilia. “It really transformed how we understand this [micro]environment, because suddenly the diffusion is no longer really important,” Shapiro said.

Diffusion is the default route for nutrients traveling through water, but it’s painfully slow. It can take as long as four minutes for oxygen to travel just 1 millimeter. That’s why the fast-moving flows created by cilia are so important: because naturally flowing water slows down near the coral’s surface, and corals consume oxygen faster than diffusion can supply it.

It is a system that delivers enough oxygen, despite the cilia’s energy consumption. But there’s a downside: Oxygen dwindles as temperature climbs. That’s when corals run into trouble.

Scientists have a clear understanding of one thing that happens to corals when water gets too hot: bleaching. As water temperatures rise, a coral’s symbiotic algae become stressed and release molecules that are toxic to the coral in large quantities. To protect itself, the coral expels its own algae—a primary food, energy, and oxygen source—and soon loses its color. It’s a slow death and an increasingly common occurrence as heat waves sweep across the world’s reefs.

But sometimes, some corals on a reef bleach while others don’t, and in other cases corals under heat stress die without expelling their algae. An international team of microbiologists, engineers, and physiologists was eager to understand how heat affects cilia, and whether this could explain different types of coral death.

Apple’s smart home device will be the AI center of the household, with it potentially becoming the poster child for Apple’s new “intelligent personal hub” strategy.

During the Apple keynote, new CEO John Ternus laid out the company’s plans for the future, including what is described as an “intelligent personal hub” approach. If a report is right, the long-rumored Home Hub will do that for the home, as the iPhone does for the person.

Outlined in the “Power On” newsletter for Bloomberg on Sunday, Mark Gurman writes that the rumored smart display will serve as the anchor for the home. It will bring together a person’s digital connected life, including device controls, video calls, and media.

The newsletter goes out of its way to suggest that Ternus’ characterization of iPhone as an already-existing “intelligent personal hub” is in some way meant to protect the company from OpenAI’s impending hardware product. Then it goes on to describe Apple’s second hub, one for the home, suggesting that Ternus has a bad hand of cards and is running out of plays in light of OpenAI’s still non-existent hardware platform.

OpenAI’s current known cash burn is $1.25 per dollar it earns, if that says anything about the danger Apple faces.

Referred to as J490, the Apple Home Hub will use an operating system focused on Siri AI, and is apparently being tested in employees’ homes. It also allegedly matches Ternus’ description of an intelligent personal hub.

Gurman goes on to reiterate various previously-rumored elements, such as the square-ish display that uses a desk-based stand that looks like half a HomePod mini, or attaches to a wall mount using magnets.

It will use facial recognition to identify users, to personalize the information it displays to that individual. However, it will do so without a Face ID-level depth sensor.

Apparently, this feat could result in facial recognition in a future iPhone Duo update, without necessarily requiring the physical space for the sensor array.

The hub will have a home screen, widgets, and clock faces, but Siri will be the main feature. It will be able to bring up information across the user’s devices and accounts, play pertinent podcasts and songs, and also carry out more precise tasks.

One thing that is still missing is a release date. So far, all of the hype about the device implies it is coming “soon,” possibly this fall, though when exactly is still a mystery.

On the outside, the iPhone 18 Pro and 18 Pro Max look identical and have the same dimensions as last year’s iPhone 17 Pro and 17 Pro Max. But on the inside, the 18 Pro and 18 Pro Max are quite different, with bigger batteries, a new A20 Pro chip, a significantly larger vapor-cooling system, and tiny mechanical aperture blades in the main camera’s lens.

As the new Apple pro phones make their way into people’s pockets, they’re also appearing in durability testing and teardown videos. 

Tech reviewer Zach Nelson dropped a pair of iPhone 18 Pro videos on his YouTube channel, JerryRigEverything: one showing how the new pro phone did in a scratch and durability test, and the other showing him dismantle Apple’s new handset.

On Sunday, the tech repair and advocacy site iFixIt did a teardown of the iPhone 18 Pro, and not all of it went according to plan. Taking the back glass panel was relatively straightforward, but there’s not much that a person can repair aside from the panel itself.

Of the four 18 Pro and 18 Pro Max models that iFixIt took apart, the plastic frame behind the display broke on three. Apple doesn’t sell the plastic frame part, so if it’s damaged, it can only be replaced by getting a whole new display module. You could put the display back on without the plastic backing frame, but it wouldn’t sit flush with the body. I should note that in Nelson’s teardown, he didn’t suffer the same calamity and gave Apple a “thumbs up for repairability” after removing the display.

“Four phones are too few to establish a failure rate. Adhesive strength, heating, technique, or a difference in the plastic could all matter. That plastic frame has been present since the 15 Pro. But it hasn’t given us nearly as much trouble in previous years,” wrote Liz Chamberlian and Carsten Frauenheim, iFixIt’s director of sustainability and repairability engineer, respectively, in a blog post. “Using isopropyl alcohol might make display removal more consistent, but we’ll have to do more testing to be sure.”

Nelson and iFixIt’s teardown, along with Apple’s Ireland site, gives us a complete picture of the battery capacity for the new iPhone Pro models, SIM card and eSIM only models. Both the iPhone 18 Pro and 18 Pro Max have larger batteries compared to last year’s 17 Pro and 17 Pro Max. The variants sold outside the US have a slightly smaller battery to afford room for a SIM card tray.

The new variable aperture on the main camera of the 18 Pro and 18 Pro Max is another curiosity. It’s made of six tiny mechanical blades. For CNET’s iPhone 18 Pro and Pro Max review video, our cinematographer, Celso Bulgatti, filmed it in action.

If any of the rear cameras on the iPhone 18 Pro or 18 Pro Max break, you’d likely need to replace the entire camera array, which includes the new mechanical aperture.

“We dismantled the main camera and concluded that an aperture-only repair isn’t going to be feasible: if your aperture gets stuck, you’ll be looking at replacing the entire main camera assembly,” noted Chamberlian and Frauenheim.

On the whole, iFixIt gave the iPhone 18 Pro and 18 Pro Max a provisional repairability score of 7 out of 10, the same as the 17 Pro and 17 Pro Max and 16 Pro and 16 Pro Max.

You can watch more of iFixIt’s findings in the company’s full teardown video below.

Patrick Holland

Director of Content

As Director of Content, Hardware, I lead CNET’s team of journalists and editors, covering news and testing on smartphones, laptops, wireless carriers, AI, and pretty much anything with a battery.

See full bio

Security researchers found two ways out of the OpenAI Codex sandbox, one of them capable of running commands on a developer’s machine from Codex’s most locked-down mode, with no approval prompt and nothing shown on screen.

Both flaws were reported to OpenAI on August 12 and fixed within eight days, according to Oren Yomtov of Accomplish AI.

The more serious of the two, which the researchers call Heapjack, turns a routine action into remote code execution: open someone else’s repository in Codex, ask it a question about the code, and whoever wrote that repository gets unsandboxed command execution on your computer.

Codex is OpenAI’s coding agent, available as a command-line tool and a desktop app. Like rival agents, it runs the model’s actions inside a sandbox so that untrusted code cannot touch the wider system. Both escapes work by defeating that boundary from the inside.

Heapjack

The Heapjack technique, as described in Yomtov’s writeup, targets a component called node_repl, which Codex Desktop writes into the global ‘~/.codex/config.toml’ file at install time.

There is no opt-in and no setting to turn it off, and because the entry lives in the shared config, plain Codex CLI users inherit the same tool without ever being asked.

node_repl runs a single Node.js process that holds two separate JavaScript execution contexts. One is trusted and contains OpenAI’s own code. The other is untrusted and runs the agent’s code. The trusted context proves it is trusted by presenting a random token generated fresh on each run.

The problem is that both contexts live in one Node process and share one memory heap, so the token is just a string sitting in memory the untrusted side can read.

The untrusted code takes a snapshot of the heap with ‘v8.getHeapSnapshot()’ and tries every string shaped like a UUID. A wrong guess returns “not authorized.” A correct token with a bad argument returns a real validation error, which tells the attacker the token is right.

With the token, the untrusted code writes its own request onto the same pipe the trusted context uses to talk to a native, unsandboxed parent process.

The parent checks the token, sees a valid one, and does the work. The proof of concept used the system’s ‘open’ command to launch an application outside Codex’s process tree entirely. The same access reaches any Unix socket, a Docker daemon socket being the obvious target, and a tool for editing the global config file.

All of this runs at read-only, the strictest sandbox mode, where the agent is not supposed to write anything at all.

Overpatch

The second flaw, Overpatch, sits in the open-source Codex CLI. In workspace-write mode, the agent may only write inside the project folder, and a shell command aimed at the home directory is refused.

The researchers got Codex’s own patch tool, apply_patch, to write there anyway.

The tool grants write access to the parent folder of each path named in a patch. Name ‘/tmp’, and it grants write access to the root of the disk.

The working exploit uses a patch with two changes: one that names ‘/tmp’ and does nothing useful except widen the permission, and one that appends a line to ‘.zshrc’ through a symlink into the home directory.

Remove the first change and the write is refused. With it, the next terminal the developer opens runs the attacker’s line unsandboxed.

The same underlying mistake

Both bugs share a shape: the enforcement mechanism was living inside the thing it was supposed to be enforcing. apply_patch worked out its own permissions from attacker-supplied input. node_repl kept the secret separating trusted from untrusted code in the same memory as the untrusted code.

In each case the sandbox was told, from the inside, to let something through.

The class of bug is not new. In July 2026, Pillar Security researchers demonstrated the same idea across Cursor, Codex, Gemini CLI and Google’s Antigravity, where an agent that stays inside its sandbox writes a file a trusted tool outside the sandbox later runs.

Reacting to Yomtov’s post on X, one commenter wrote that “V8 contexts isolate globals, not memory, so the sandbox was really a promise the heap never agreed to.” Another called the trust boundary “a room divider.” The default-enabled behavior drew its own scrutiny, with one asking why a privileged token was reachable from untrusted JavaScript at all.

What to do

OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, according to Accomplish.

Users should update to those versions or later. Yomtov credited OpenAI with resolving both issues within eight days of his report.

BleepingComputer reached out to OpenAI for comment prior to publishing.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Xbox mode doesn’t reinvent the PC gaming experience, but it has a few nice touches.

How to enable and open Xbox mode in Windows 11

Max Miller for Engadget

What does Xbox mode actually do in Windows 11?

Max Miller for Engadget